CRMP - NDPA 2023 GAID 2025 - BIC Advisory NDPA (2023

About the Nigeria Data Protection Act 2023 – General Application and Implementation Directive (GAID) 2025

The Nigeria Data Protection Act (NDP Act) 2023 and its General Application and Implementation Directive (GAID) 2025 represent Nigeria’s comprehensive framework for personal data protection. Issued pursuant to Section 37 of the 1999 Constitution of Nigeria and administered by the Nigeria Data Protection Commission (NDPC), these regulations establish binding obligations for data controllers and processors across all sectors.

The GAID provides detailed implementation guidance for the NDP Act, covering 52 articles and 10 comprehensive schedules. It establishes standards for data processing, cross-border transfers, emerging technologies, and enforcement mechanisms. Compliance with these provisions is mandatory for all entities processing personal data of individuals in Nigeria, regardless of where the processing occurs.

Key Regulatory Framework Elements

Constitutional Foundation – Based on Section 37 of the 1999 Constitution guaranteeing privacy rights
Universal Application – Applies to any processing of personal data of individuals in Nigeria
Three-Tier Classification – Ultra-High Level (UHL), Extra-High Level (EHL), Ordinary-High Level (OHL)
Data Protection Officer Mandate – Required for all major importance entities with certification requirements
Cross-Border Transfer Controls – Adequacy decisions and approved transfer instruments required
Emerging Technology Governance – Special provisions for AI, IoT, blockchain deployments
Data Subject Rights – Comprehensive rights framework with enforcement mechanisms

Primary Compliance Objectives

Safeguard constitutional right to privacy under Section 37 of the 1999 Constitution
Foster trusted use of data in building sustainable digital economy
Ensure data sovereignty and national adequacy of data protection
Promote compliance with international data protection standards
Establish effective redress mechanisms for data subjects
Support innovation while protecting fundamental rights and freedoms
Strengthen legal foundations of national digital economy participation

Article

Title

Regulatory Description

Compliance Obligation

Risk Description

Controls

Art. 7 (a-w)

General NDP Act Compliance Measures

a) Register with the Commission as a data controller or data processor of major importance as the Commission may determine in accordance with the NDP Act.
b) Conduct a NDP Act compliance audit within Fifteen (15) months of commencement of business and thereafter on an annual basis;
c) In the case of data controllers and data processors of major importance (Ultra High Level and Extra-High Level as defined in Article 8 of this NDP ActGAID), file NDP Act Compliance Audit Returns (CAR) with the Commission not later than the 31st of March of each year;
d) Identify all its obligations under the NDP Act and prepare schedules of compliance;
e) Prepare and keep semi-annual data protection reports which shall be a detailed analysis of data processing within six (6) months;
f) Prepare and follow Schedules on Monitoring Evaluation and Maintenance of Data Security System in order to guarantee data confidentiality, integrity and availability;
g) Prepare and follow schedules on organisation-wide, internal sensitisation and training on data privacy and protection in order to foster a culture of compliance with the NDP Act and best practices; i) In the case of a data controller or data processor of major importance, designate a Data Protection Officer (DPO). Associate DPOs/Privacy Champions may be designated to support the DPO where the data controller or the data processor carries out data processing or interfaces with data subjects on multiple platforms and places;
h) Identify all obligations relating to data controllers or data processors under the NDP Act and prepare schedules of compliance;
i) In the case of a data controller or data processor of major importance, designate a Data Protection Officer (DPO). Associate DPOs/Privacy Champions may be
designated to support the DPO where the data controller or the data processor carries out data processing or interfaces with data subjects on multiple platforms and places;
j) Develop or review its organisational privacy policies, the privacy policy shall be in compliance with the NDP Act;
k) Publish its organisational privacy policies on its platforms with a view to sensitising data subjects on data processing activities as well as rights and duties in connection therewith;
l) Provide privacy and cookie notices at the homepage of its website. The cookie notice should give a data subject the opportunity to decline or accept the notice; A cookie notice must be displayed in such a way that it significantly obstructs the middle, the left or the right side of the home page of a website. Displaying a cookie notice at the bottom of a webpage where it may be ignored or be unnoticed by a data subject is tantamount to lack of transparency in data processing.
m) Ensure that the privacy policy and notice is transparent and appropriately provided on platforms/places where data processing is taking place; and without prejudice to the NDP Act, it shall also take into account specific directions on privacy by relevant Application Hosting Platforms through which a data subject may access its services;
n) Develop and circulate an internal data protection strategy or policy and basic privacy checklist to help members of staff and other relevant persons (such as vendors, agents and contractors) understand the organisation’s direction in connection with the processing of personal data and outline the steps they are to take to ensure the organisation’s direction is maintained;
o) Conduct a Data Privacy Impact Assessment (DPIA) when required under the NDP Act, or when directed by the Commission;
p) Notify the Commission of personal data breaches within seventy-two (72) hours of becoming aware of the breach;
q) Notify a data subject immediately after becoming aware of a personal data breach that may pose high risk to his or her privacy;
r) Update agreements with third party processors to ensure compliance with the NDP Act;
s) Design systems and processes to make data requests and access seamless for data subjects;
t) Design systems and processes to enable data subjects to easily correct or update their personal data;
u) Design systems and processes to enable data subjects easily transfer data to another platform or person (natural or artificial);
v) At least within the six (6) months of commencement of business and then, at the minimum, on an annual basis, train its personnel on data protection law and practices; and
w) Clearly explain the complaints process to data subjects including the right to lodge a complaint with the Commission.

The organisation must:

Register with the NDPC if it is a major data controller or processor.
Identify and document all compliance obligations under the NDP Act.
Develop monitoring and evaluation schedules to maintain data security (confidentiality, integrity, availability).
Carry out organisation-wide sensitisation and training on data privacy.
Appoint a Data Protection Officer (DPO) and designate privacy champions where necessary.
• Develop, review, and publish privacy policies that comply with the Act and ensure they are transparent.
Provide prominent cookie notices that allow data subjects to accept or decline.
Circulate an internal privacy strategy and Basic Privacy Checklist for staff, vendors, and contractors.
Conduct Data Protection Impact Assessments (DPIAs) when required.
Notify data subjects promptly of breaches that may pose high risks.
Update agreements with third-party processors to reflect compliance obligations.
Put in place systems for data subjects to access, correct, update, and transfer their data.
Train staff on data protection within six months of commencement and at least annually thereafter.
Provide a clear complaints process, including the right to escalate to the NDPC.

Non-compliance can lead to regulatory sanctions, administrative fines, reputational damage, legal liabilities, data breaches, erosion of trust, inability to defend against complaints, and harm to data subjects’ rights and freedoms.

Maintain an up-to-date NDPC registration certificate (renewed as required).
Compliance Risk Management Plan (CRMP) maintained and updated periodically.
Information Security Management System (ISMS) with documented monitoring and incident response.
Annual privacy training programme with attendance logs and e-learning modules.
Designated DPO formally appointed, with privacy champions embedded in business units.
Published privacy policy on website and intranet, with periodic review schedule.
Cookie banner/notice deployed on homepage with opt-in/opt-out functionality.
Internal Privacy Strategy & Basic Privacy Checklist circulated to staff, vendors, contractors.
DPIA framework and template adopted, applied to high-risk/new processing activities.
Data breach notification procedure tested through tabletop exercises.
Third-party contract clauses on data protection embedded in vendor agreements.
Data Subject Request (DSR) portal/process operational with defined SLAs.
Annual compliance audit conducted, with reports to Board/NDPC.
Complaints handling procedure documented, with escalation path to NDPC.

Art. 8 (1-4)

Designation of DCMI

(1) Section 65 of the NDP Act provides, “data controller or data processor of major importance” means a data controller or data processor that is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate.
(2) “Operating in Nigeria” as stated in section 65 includes a data controller or a data processor who targets a data subject in Nigeria. Such data controller or processor may not be domiciled in or resident in Nigeria. This is taking into consideration the provision of section 2(2)(a) of the NDP Act on the Application of the Act as well as sections 24(3) and 44 on the need to hold accountable data controllers and processors whose processing activities significantly impact the economy, society or security of Nigeria.
(3) In carrying out an objective assessment of what is of value or significance to the economy, society or security of Nigeria, the Commission shall take into consideration all relevant factors – including but not limited to the following: a) The risks that the data processing by a data controller or a data processor poses to a data subject if such data controller or data processor is not under the obligation imposed by the NDP Act on a data controller or a data processor of major importance as contemplated by section 29(1)(a) of the NDP Act; … i) The need for international standard certifications for people, processes and technologies involved in data confidentiality, integrity and availability.
(4) In order to ensure proportionality of obligations in relation to various levels of major data processing, the Commission classifies data controllers and data processors into 3 (three) levels or categories of major data processing, namely:
(a) Ultra-High Level (UHL)
(b) Extra-High Level (EHL)
(c) Ordinary-High Level (OHL)

The organisation must:

Register with the NDPC if designated as a DCMI.
File annual CAR if classified as UHL or EHL.
Renew registration annually if classified as OHL (CAR not required).
Notify the NDPC within 60 days of any significant change to registration information.
Request removal from the DCMI register if it no longer qualifies.
Pay all outstanding registration fees, even after removal.

Failure to recognise or declare DCMI status may lead to misclassification, non-registration, penalties, reputational harm, and exposure to heightened scrutiny. Misjudging applicability may also cause gaps in security, governance, and international compliance.

Data processing register maintained, with thresholds tracked against NDPC classification criteria.
Legal and compliance function monitors NDPC guidelines for DCMI designation; Cross-border compliance framework ensures foreign processing targeting Nigerians is captured.
Risk assessment process evaluates economic, societal, and security impacts of data processing.
Adoption of international certifications/standards (e.g., ISO 27001, ISO 27701, GDPR adequacy practices).
Governance framework aligning processing activities with NDPC’s UHL, EHL, OHL classification model; Board oversight for major data processing decisions and resource allocation.

Art. 9 (1-6)

Registration as DCMI

(1) A data controller or a data processor of major importance as designated by the Commission shall register with the Commission in accordance with the Guidance Notice issued by the Commission and reproduced in this GAID as Schedule 7.
2) A data controller or a data processor in the category of UHL or EHL shall register
once and shall only be required to file CAR annually.
(3) A data controller or a data processor in the category of OHL shall renew its
registration with the Commission on an annual basis and it shall not be required to
file annual CAR when it renews its registration annually.
(4) A data controller or data processor of major importance shall notify the Commission of any significant change to the information submitted in its most recent registration submission within sixty (60) days after such change by providing any information required by the Commission through any electronic submission system provided by the Commission, or in the absence of which by email to an address provided by the Commission for such purpose.
(5) If a data controller or data processor no longer qualifies as a data controller or data processor of major importance, they may request removal from the register by providing the information required by the Commission through any electronic submission system provided by the Commission, or in the absence of which by email to an address that the Commission shall publish on its website.
(6) Notwithstanding its removal from the register, a former data controller or data processor of major importance shall remain responsible for payment of any outstanding fees from the then-current and any prior annual registration periods.

The organisation must:

Register with the NDPC if designated as a DCMI.
File annual CAR if classified as UHL or EHL.
Renew registration annually if classified as OHL (CAR not required).
Notify the NDPC within 60 days of any significant change to registration information.
Request removal from the DCMI register if it no longer qualifies.
Pay all outstanding registration fees, even after removal.

Failure to register or renew exposes organisations to regulatory penalties, invalid processing status, reputational damage, loss of legal cover for operations, and potential suspension of processing activities. Late or non-notification of changes creates compliance breaches and risks of investigation.

Registration certificate obtained and kept up to date with NDPC.
Regulatory compliance calendar tracks CAR filing (for UHL/EHL).
Regulatory compliance calendar tracks annual renewal (for OHL).
Compliance officer/DPO oversight; Change notification procedure in place to inform NDPC within 60 days.
Internal process for deregistration when business no longer qualifies as DCMI.
Finance/legal tracking system ensures settlement of all outstanding registration fees.

Art. 10 (1-5)

NDP Act CAR Filing

(1) A data controller or a data processor shall carry out periodic compliance audit of its data processing activities with a view to mitigating the risk of data breaches through appropriate technical and organisational measures.
(2) In order to carry out an audit, a data controller or a data processor shall adopt a risk based approach as may be associated with people, processes and technologies involved in its data processing value chain.
(3) A data controller or a data processor shall develop or adopt privacy audit controls in line with global best practices. Each model of audit may comprise of a series of techniques ranging from simple to complex and technical to organisational.
(4) A data controller or data processor shall identify each point of risk and determine the techniques and frequency of audit to be carried out on each point of risk subject to any directive by the Commission.
(5) Where personal data may be accessed from an online device of a data controller or data processor, such personal data is vulnerable to data security breach by means of cyber technology. The audit of such online device shall be as frequently as possible.

The organisation must:

Conduct periodic compliance audits of data processing.
Apply a risk-based approach across people, processes, and technology.
Adopt audit models/controls in line with global standards.
Map risks and set audit frequency/techniques.
Audit online systems/devices frequently to address cyber risks.

Failure to conduct proper audits increases risk of data breaches, regulatory non-compliance, administrative sanctions, reputational harm, operational disruption, and loss of trust with stakeholders.

Annual compliance audit plan documented and approved; Compliance Audit Returns (CAR) submitted to NDPC annually.
Risk-based audit methodology integrated into audit function.
Privacy audit framework aligned with ISO 27001/27701 and GDPR standards.
Risk register mapping audit points and frequency.
Cybersecurity audits/penetration tests scheduled for all online systems.

Art. 11 (1-2)

Designation of a Data Protection Officer

(1) Section 32 of the NDP Act mandates the designation of a DPO, accordingly, the DPO may be a member of staff of the data controller or data processor, or fulfil the tasks on the basis of a service contract.
(2) The data controller or the data processor shall publish the contact details of the DPO and communicate the same to the Commission in the prescribed form.

The organisation must:

Appoint a qualified DPO (internal staff or contracted).
Publish the DPO’s contact details.
Notify the NDPC with the DPO’s details in the prescribed format.

Failure to designate and disclose a DPO exposes the organisation to non-compliance penalties, weak accountability, ineffective data protection governance, inability to handle data subject rights requests, and reputational harm.

DPO appointment letter/contract on record.
Contact details of DPO published on website and staff intranet.
Formal notification to NDPC submitted in required format.

Art. 12 (1-8)

Position of a Data Protection Officer

(1) A data controller or a data processor shall actively engage its DPO in all issues which relate to the processing of personal data.
(2) The data controller or data processor shall give appropriate support to the DPO in performing the data protection responsibilities as prescribed by the NDP Act or by the Commission. Accordingly, the data controller or data processor shall put in place the necessary organisational measures, namely: a) Provide necessary resources to the DPO to carry out data protection tasks; b) Ensure access to personal data processing activities and processing operations; and c) Make adequate provision for continuous training for the DPO.
(3) The data controller or data processor shall ensure that the DPO does not carry out his or her task under duress, coercion, covert or overt influence.
(4) He or she shall not be dismissed or penalised by the data controller or the data processor for performing his or her tasks.
(5) The DPO shall directly report to the management level of the controller or the processor.
(6) Data subjects may contact the DPO with regard to all issues relating to the processing of their personal data and to the exercise of their rights under the NDP Act.
(7) The DPO shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with relevant legislation.
(8) The DPO may fulfil other tasks and duties. The data controller or data processor shall ensure that any such tasks and duties do not result in a conflict of interest.

The organisation must:

Involve the DPO in all matters relating to data processing.
Provide resources, access, and continuous training for the DPO.
Protect the DPO from dismissal, coercion, or undue influence.
Ensure direct reporting to senior management.
Allow data subjects to contact the DPO.
Ensure confidentiality obligations are observed.
Avoid conflicts of interest if the DPO holds additional roles.

Risk of non-compliance if the DPO lacks independence or authority.
Risk of conflict of interest undermining DPO effectiveness.
Risk of breach of confidentiality by DPO.
Risk of regulatory fines if DPO not properly empowered.

Board-approved DPO charter defining authority and independence.
Budget allocation for DPO function (training, tools, staff).
Whistleblowing/anti-retaliation policy protecting DPO role.
HR policy explicitly prohibiting dismissal/penalisation of DPO for role-related tasks.
DPO reporting line established to senior management/Board.
Publication of DPO contact details (website, intranet, privacy notices).
Confidentiality agreement signed by DPO.
Conflict of interest policy covering DPO’s additional roles.

Art. 13 (1-5)

Submission of Internal Semi-Annual Data Protection Report by a Data Protection Officer

(1) A data controller or a data processor shall ensure that a semi-annual data protection report is compiled by its DPO and submitted to its management.
(2) The report shall be submitted to an officer of the data controller or data processor who is authorised to receive a Record of Processing Activities (RoPA).
(3) The report shall be acknowledged by the receiving officer and shall form part of the ROPA by the data controller or data processor.
(4) The report shall be verified by a DPCO during the NDP Act compliance audit.
(5) The report to be submitted by the DPO shall among others, contain the compliance status of the data controller or data processor under the NDP Act – particularly taking into account:
(a) Assessment of privacy notices – taking the requirements of the NDP Act into account.
(b) Types of data being processed by the data controller or data processor.
(c) Principles of data protection as applicable to the processing activities of the data controller or data processor.
(d) Lawful bases of data processing as applicable to the processing activities of the data controller or data processor.
(e) The need for DPIA where it is applicable to the processing activities of the data controller or data processor.
(f) Legitimate Interest Assessment (LIA) as applicable to the processing activities of the data controller or data processor.
(g) Ease of data subjects in exercising their rights. (h) Data subjects’ complaints and remediation (if any).
(i) Notices issued by the Commission (if any).
(j) Guidance sought from the DPCO, if any.
(k) Assessment of data security.
(l) Legal grounds for cross-border data transfer. (m) Breach notification to the Commission and to data subjects.

The organisation must:

Ensure the DPO prepares and submits semi-annual reports to management.
Incorporate reports into RoPA.
Address key compliance areas (notices, lawful basis, DPIA, LIA, rights, breaches).
Facilitate DPCO verification during audit.

Risk of regulatory non-compliance if reports not prepared.
Risk of incomplete compliance monitoring without proper reporting.
Risk of missed red flags on breaches, DPIAs, or LIAs.
Risk of audit findings due to lack of documentation.

DPO reporting schedule set bi-annually.
Reports routed to authorised RoPA officer via formal submission workflow.
Audit trail of submitted/acknowledged reports maintained within RoPA system.
Independent verification by appointed DPCO during compliance audit.
Compliance checklist template used for DPO reporting, covering:
a) Privacy notices assessment documented.
b) Data inventory maintained to track types of data processed.
c) Checklist includes assessment of principles of data protection.
d) Documentation of lawful basis for each processing activity.
e) DPIA reports prepared where applicable.
f) Legitimate Interest Assessments documented where applicable.
g) Data subject rights log maintained and reviewed.
h) Complaints register and remediation actions documented.
i) Notices from NDPC tracked and recorded in compliance system.
j) Record of consultations/guidance sought from DPCO maintained.
k) Information security assessments included in report.
l) Cross-border transfer assessments documented, including legal grounds.
m) Breach log maintained with evidence of notifications to Commission and data subjects.

Art. 14 (2,4,8)

Credential Assessment of a Data Protection Officer

(2) The Commission shall carry out Annual Credential Assessment (ACA) of DPOs in order to ensure that each DPO maintains the level of professionalism required to carry out his or her responsibilities towards safeguarding the rights and interests of data
subjects as required under the NDP Act, relevant case laws and any regulatory instrument issued by the Commission.

(4) A DPO shall be guided by the provisions of the NDP Act, this GAID, the Code of Conduct for Data Protection Compliance Organisations (DPCOs) and any other relevant instrument issued by the Commission. Similarly, directives, codes or guidance relating to professionalism and ethics issued by any professional body to which a DPO belongs shall also be taken into account.

(8) The verification of certification under Sub-Article 5 of this Article shall be a medium through which the Commission may determine if the person designated as a DPO is a fit and proper person to carry out the duties contemplated by section 32 of the NDP Act and in particular his or her proficiency in safeguarding the rights of data subjects at organisational level.

The organisation must:

Ensure its DPO undergoes annual ACA by NDPC.
Require DPO adherence to codes of conduct and professional ethics.
Verify the DPO is properly certified and fit for role.

Risk of disqualification if the DPO fails ACA.
Risk of regulatory sanctions if DPO lacks credentials.
Risk of loss of compliance credibility.

ACA compliance calendar maintained to track annual assessments.
Professional CPD (Continuing Professional Development) tracked, with reference to NDP Act, GAID, DPCO Code of Conduct, and other relevant instruments.
DPO credential/certification records updated annually, with internal HR/legal checks confirming DPO’s fitness and ethical compliance.

Art. 15 (1-2)

Principles of Personal Data Protection

(1) The entire principle of data protection are obligatory in any form of data processing. The principles under section 24 of the NDP Act are:
a) Fairness, lawfulness and transparency of data processing,
b) Purpose limitation,
c) Data minimisation and ethics,
d) Storage limitation,
e) Data accuracy,
f) Data confidentiality, integrity and availability,
g) Accountability, and
h) Duty of care.
(2) The scope of the foregoing principles is more particularly described in Schedule 1 of this GAID.

The organisation must:

Apply all 8 principles of data protection in every processing activity.
Ensure compliance with Schedule 1 of GAID.

Risk of systemic non-compliance if principles not embedded in processes.
Risk of breach of rights (accuracy, transparency, duty of care).
Risk of fines and reputational damage.

Data Protection Policy embedding principles; Data minimisation controls in IT systems; Retention/disposal schedules for storage limitation; Encryption and access controls for confidentiality/integrity; Audit logs for accountability; Staff training on principles.
Compliance checklists/procedures aligned with Schedule 1 of GAID.

Art. 16 (1-3)

Lawful Bases of Data Processing

(1) In line with Section 25 of the NDP Act, it is important for a data controller to carefully assess the lawful bases of data processing before embarking on same.
(2) Subject to the provisions of the NDP Act and any regulatory instruments issued by the Commission, a data controller shall carefully consider and choose the appropriate lawful bases of data processing in order to process personal data. The lawful bases are:
a) Consent
b) Contractual Obligation
d) Legal Obligation
e) Valid Interest
f) Public Interest
g) Legitimate Interest.
(3) As the party who determines the purpose of data processing, the data controller is ultimately responsible for determining the lawful bases of data processing

The organisation must:

Carefully assess and document lawful basis before processing data.
Use only recognised bases (consent, contract, legal obligation, vital interest, public interest, legitimate interest).

Risk of illegal/unlawful processing if no valid basis.
Risk of invalid consent or misused legitimate interest.
Risk of legal challenge or fines.

Templates/checklists for assessing lawful basis; DPO/legal review of new processing activities; Documentation of consent/contract/legal obligation where applicable.
Lawful Basis Register maintained for all processing.

Art. 17 (1-2, 6-9)

Reliance on Consent

(1) Considering that data privacy is a fundamental right to informational self-determination, it is prudent for a data controller to prioritize the interest of the data subject which may be effectively addressed through his or her informed consent.
(2) Where reliance on consent may effectively defeat the rule of law, another lawful basis may be considered.
(6) Whenever a data controller relies on consent, it shall keep a proper record that guarantees accountability in respect of the consent.
(7) In determining whether a data controller is accountable in the mode of obtaining consent, the data controller shall:
a) Provide appropriate information to the data subject such that the data subject, on the basis of the information, may make an informed decision;
b) Make the process of withdrawal of consent as easy as giving consent; and
c) Ensure that refusal of consent is not detrimental to the rights and interests of the data subject.
(8) Nothing in this GAID shall prevent a data subject from giving a constructive or an implied consent to data processing in the following circumstances: a) A data subject’s acts of participation in a public event and the images taken in that event may be used for a report of that event – provided that such images shall not be used for profit or commerce-oriented advertisement without the express consent of the data subject. A data controller in this circumstance shall ensure that images captured do not portray data subjects in a bad light. In addition to other measures of duty of care, a data controller may put participants on notice that images captured may be used for reporting, journalistic or other purposes permitted by the NDP Act. b) Subject to the NDP Act and Article 18 of this GAID, a data subject’s act of closing a privacy notice displayed on the centre of a webpage and which notice significantly obstructs the viewing of the webpage – provided that the data collected in such circumstances is limited to processing of personal data which is necessary to basic functionality of the website. Basic functionality means such functions that permit the website to respond to and analyze the interactions of the data subject with the website.
(9) At all times where consent is required, a data subject shall be provided with a clear and explicit option to accept or to decline.

The organisation must:

Obtain informed consent with clear information.
Provide easy withdrawal and ensure refusal does not harm rights.
Keep detailed records of consent.
Limit implied consent to permitted cases (e.g., event reporting, functional cookies).

Risk of invalid consent leading to unlawful processing.
Risk of breach of rights if withdrawal is difficult or refusal penalised.
Risk of NDPC sanctions for improper reliance on consent.

Clear consent forms and privacy notices; Consent management system in place.
Withdrawal mechanism (e.g., unsubscribe, opt-out toggle).
Consent logs for audit trail.
Policy limiting implied consent to narrow legal use cases.

Art. 18 (1a-f)

Data Processing Which Requires Consent

(1) Without prejudice to the provisions of the NDP Act and in addition to other circumstances in which consent may be required under this GAID or by operation of law, consent is required:
a) For any direct marketing activity;
b) For the processing of sensitive personal data;
c) For further processing that is incompatible with the original purpose of processing;
d) For the processing of the personal data of a child;
e) Before personal data may be transferred to a country in respect of which the Commission has not made an adequacy decision; and
f) Before the data controller makes a decision based solely on automated processing which produces legal effects concerning or significantly affecting the data subject.

Consent required for: (a) direct marketing, (b) processing sensitive personal data, (c) incompatible further processing, (d) processing of children’s data, (e) transfers to non-adequate countries, (f) automated decision-making with legal/significant effects.

Risk of illegal processing if done without valid consent.
Risk of exploitation of minors if children’s data not safeguarded.
Risk of regulatory fines for unlawful cross-border transfers.
Risk of discrimination/rights violations from automated decision-making.

Marketing opt-in records maintained
Consent management system logging consent by type
Data processing change log maintained to capture and assess further processing against original purpose
Parental consent verification mechanism for child data
Data transfer register tracking adequacy decisions
Automated processing safeguards (human review options)

Art. 19 (1-7)

Consent to Cookies and Other Tracking Tools

(1) Operation of cookies and other tracking tools shall comply with the principles of data protection under section 24 of the NDP Act.
(2) Except as otherwise provided by this GAID, the use of cookies on a website or other digital platforms requires consent.
(3) The consent shall be freely given, informed and specific.
(4) A Data Controller/Data Processor should display a cookie banner in a manner that is conspicuous and obvious to a user or site visitor.
(5) Necessary cookies which do not process sensitive data, financial data or any data stored privately by a data subject does not need the ticking of a box or similar methods;
(6) In this article “necessary cookies” means cookies that enable core functionality such as security, network stability management, and accessibility. All other forms of cookies require a specific selection of “yes or no” (alternatively: “except” or “reject”) options presented to the data subject.
(7) In deploying cookies, website owners are required to:
a) Make cookies notice banner or display conspicuous. Accordingly, a data subject shall not be required to scroll to any part of a website before seeing the cookie banner. Similarly, every tracking tool shall be made known to the data subject at the section of the web page which appears first;
b) Make cookie listing onto clear and easy to understand;
c) Notify users of the presence and purpose of the cookies;
d) Identify the organisation responsible for the use of the cookies; and
e) Provide information on how to withdraw consent from the use of the cookies.

The organisation must:

Use cookie banners that are clear, visible, and require consent for non-essential cookies.
Inform users of types and purposes of cookies.
Identify the entity responsible for cookies.
Provide withdrawal mechanisms

Risk of non-compliance with transparency obligations.
Risk of invalid consent from hidden or pre-ticked cookies.
Risk of sanctions for profiling/tracking without consent.

NDP Act–compliant cookie banner in use.
Cookie policy published and linked from banner.
Cookie banner and policy explicitly identify the responsible entity.
Withdrawal options integrated (e.g., “manage cookies” link).

Art. 20 (1-2)

Lawfulness of Purpose, Reliance on Consent, and Other Lawful Bases

(1) In addition to other obligations under the NDP Act and this GAID, every data processing shall only proceed from purposes that are: i. Lawful under the NDP Act; ii. Not in violation of other legislation for the time being in force in Nigeria, and iii. Not in violation of preemptory norms of general International Law.
(2) No consent shall be sought, given or accepted in any circumstance that may engender direct or indirect propagation of atrocities, hate, child rights violations and criminal acts.

The organisation must:

Ensure every processing activity has a lawful, legitimate purpose.
Avoid consent/processing for unlawful or harmful purposes.

Risk of invalid processing if based on unlawful purpose.
Risk of criminal liability if processing relates to prohibited acts.
Risk of loss of NDPC approval for compliance failures.

Lawful Purpose Register documenting basis for each processing.
Screening mechanism to prevent unlawful data use (e.g., hate, exploitation).

Art. 21 (1-3, 5)

Reliance on Contract

(1) At the preliminary stage of a contract with a data subject, a data controller or data processor may carry out data processing on the data subject for the purpose of due diligence.
(2) Where the contract did not materialise, any personal data collected relating to the data subject shall be destroyed within six (6) months unless there is a justifiable ground to archive the data for the purposes of any future legal claim.
(3) A contract with a data subject involving data processing shall make provision for termination of the contract prior to the tenure of the contract.
(5) Pursuant to Section 46 of the 1999 Constitution and Section 34(1)(a)(v) of the NDP Act, a specific term of a contract on personal data processing that ousts or purports to oust the adjudicatory jurisdiction of Nigerian courts or the executive jurisdiction of the Commission shall be treated as void.

The organisation must:

Limit pre-contract data use to due diligence.
Delete/justify retention if contract not executed (within 6 months).
Include early termination clause in contracts.
Avoid unlawful contract clauses that override NDPC/court oversight.

Risk of data misuse during contract negotiations.
Risk of over-retention of personal data if contracts fail.
Risk of contract invalidity if clauses exclude NDPC/courts.

RoPA entries for contract-related processing.
Data retention schedule (6-month rule for failed contracts).
Standard contract template includes early termination clause reviewed by Legal/DPO.
Contract templates reviewed by Legal/DPO; contract approval workflow includes legal review.

Art. 22 (1-8)

Legal Obligation

(1) A legal obligation means any one of the following: a) a specific duty imposed by law; b) an order of a court of competent jurisdiction; or c) a responsibility incidental to an obligation imposed by law to carry out an act which requires the processing of personal data.
(2) Where a legal obligation derogates from the general safeguards of the NDP Act, it shall be treated as a derogation from the right to privacy as enshrined under Section 37 of the 1999 Constitution, and accordingly, Section 45 of the 1999 Constitution applies.
(3) In line with Section 45 of the 1999 Constitution, data processing shall only take place in such circumstances of derogation as stipulated in Sub-Article (2) of this Article if the enabling law for the said legal obligation is reasonably justifiable in a democratic society and: i. it is in the interest of defence, public safety, public order, public morality or public health; or ii. for the purpose of protecting the rights and freedom of other persons; accordingly, account shall be taken of practices in a democratic society where the rule of law is firmly entrenched.
(4) Data processing under legal obligation shall be strictly limited to the minimum requirement under a law in line with Sub-Article (3) above and shall not be used for a voyage of discovery into the privacy of a data subject or in circumstances of establishing a speculative claim.
(5) In any circumstance where a legal obligation for data processing is to be imposed on a data controller or data processor, account shall be taken of any less intrusive method of processing proposed by anyone of the following persons:
a) The affected data subject;
b) The Commission;
c) The concerned data controller or data processor; d) A non-governmental organisation in the field of human rights advocacy; and
e) The media.

(6) Without prejudice to the NDP Act, a data controller or data processor who is in possession of the personal data of a data subject may rely on the written opinion of its DPO in order to satisfy itself with:
a) The legal competence of the authority demanding the processing of personal data under a legal obligation;
b) The measures provided for the protection of personal data in accordance with the principles of data protection set forth in Section 24 of the NDP Act;
c) The scope of the processing as contained in a competent order, warrant or administrative directive;
d) Access of the data subject to applicable data subjects’ rights in accordance with Part VI of the NDP Act; and
e) The enforceability of data subjects’ right against unfair data processing – taking into account the principles of necessity and proportionality.
(7) Whenever a data controller or a data processor is dissatisfied with an administrative order, warrant or directive regarding the processing of personal data, he or she may seek guidance from the Commission in line with Section 3(4) of the NDP Act and shall take the safeguards mandated under this Article into account.
(8) Whenever a data controller or a data processor or the affected data subject is dissatisfied with a judicial order regarding the processing of personal data, he or she may approach a court of competent jurisdiction to seek a variation or the setting aside of the order in accordance with binding judicial precedents.

The organisation must:

Process personal data under legal obligation only if law/court order applies.
Ensure derogations are strictly limited and justifiable.
Apply proportionality and safeguard data subjects’ rights.
Seek NDPC/court review if dissatisfied with orders.

Risk of rights violations if processing exceeds lawful scope.
Risk of overreach by authorities without safeguards.
Risk of regulatory/judicial penalties for misuse of legal basis.

Legal Obligation Register documenting processing tied to laws/orders.
Derogation log documenting justification and approval before reliance.
Safeguard checklist for necessity/proportionality applied.
Escalation protocol for challenging unlawful orders (NDPC/courts).

Art. 23 (1-2)

Evaluation of Lawful Bases of Data Processing

1. In all adjudicatory or administrative proceedings pertaining to personal data processing, it shall be essential to the character of a democratic society to meticulously evaluate:
(a) The necessity of processing of personal data – taking into consideration the risks and the alternatives (agency;
(b) The duty of care and the standard of care employed to mitigate unnecessary, disproportionate risks of data processing;
(d) The proportionality of the processing of personal data – taking into account:
i. the scope of measures adopted or intended to be adopted for the processing of personal data in relation to the ii. the legitimate aim pursued. Duty of care shall be exercised in favour of the data subject and/or other data subjects whose fundamental rights and freedoms that may be affected. It is obligatory to avoid the setting of procedures which are prejudicial to fundamental rights and freedoms. It is prudent and obligatory to avoid any data processing that may undermine the adequacy of data protection which exists within the Federal Republic of Nigeria.
(2) Nothing in the NDP Act, this GAID, any legislation, or any legal instrument shall be deemed as authorising any form of data processing without compliance with Sections 37 and 45 of the 1999 Constitution of the Federal Republic of Nigeria. For ease of reference, the sections provide: Section 37 CERN 1999: The privacy of citizens, their homes, correspondences, telephone conversations and telegraphic communications is hereby guaranteed and protected. Section 45(1) CERN 1999: Nothing in sections 37, 38, 39, 40 and 41 of this Constitution shall invalidate any law that is reasonably justifiable in a democratic society.
(a) In the interest of defence, public safety, public order, public morality or public health; or (b) for the purpose of protecting the rights and freedom or other persons.

The organisation must:

Evaluate necessity, proportionality, and risks before processing.
Apply duty of care in protecting rights/freedoms.
Avoid procedures undermining adequacy of data protection.
Ensure all processing aligns with constitutional safeguards.

Risk of unlawful processing if not based on lawful basis.
Risk of breach of constitutional rights.
Risk of regulatory sanctions for disproportional or unnecessary data use.

Lawful Basis Assessment templates in use.
Duty of Care policy embedded into processing procedures and staff training.
Data ethics board/committee reviews proportionality.
DPO/legal review of processing activities; RoPA entries showing lawful basis decisions.

Art. 24 (1-4)

Reliance on Vital Interest

(1) A data controller may rely on vital interest as a lawful basis for the processing of personal data, particularly when circumstances do not permit the data subject to give consent to the processing.

(2) The vital interest referred to in Sub-Article (1) of this Article may be that of the data subject or of a third party and it shall meet the conditions stipulated below:
a) The processing is necessary for the preservation or protection of life or livelihood and failure or refusal to act may be harmful to the data subject or a third party;
b) There is a legitimate expectation based on relationship or connection, operation of law, convention or prevailing norms that personal data should be processed in such circumstances of vital interest; and
c) The data controller or data processor may be called into question as being negligent, unprofessional or reckless for failing to carry out the data processing in such adverse circumstances in which a vital interest is in jeopardy.
(3) The method of processing employed for the purposes of vital interest shall be necessary and proportionate.
(4) The data controller shall give an account of its processing to the affected data subject, his or her representative in interest, or to a competent authority upon request.

The organisation must:

Use vital interest basis only in emergencies where life/livelihood is at risk.
Ensure proportionality.
Document processing and inform affected parties/authorities.

Risk of abuse of “vital interest” to justify improper processing.
Risk of negligence if failure to act harms individuals.

Emergency protocols defining triggers and safeguards.
Proportionality checklist embedded into emergency processing workflow.
Vital Interest Register logging emergency processing cases; DPO oversight of all vital interest claims.

Art. 25 (1-4)

Reliance on Public Interest

(1) Public interest may be relied upon as a lawful basis of data processing in circumstances where there is:
(a) a public health or humanitarian emergency; or (b) there is a clear and present danger to public safety; or
(c) there is a need also address direction of destination or deprivation for the benefit of the data subject. In furtherance of the Fundamental Objectives and Directive Principles of State Policy or Sustainable Development Goals.

(2) In addition to other obligations that may be imposed under the NDP Act, in any regulatory instrument issued by the Commission and any other legislation, a data controller shall take into account the safeguards in the provisions of Article 23 of this GAID when carrying out data processing on the ground of public interest.

(3) The method of processing employed for the purposes of public interest shall be necessary and proportionate.

(4) Article 23 of this GAID regarding the evaluation of legal obligation shall also apply to the evaluation of public interest when it is relied upon as a lawful basis of data processing.

The organisation must:

Process data on public interest basis only where justified (e.g., health, safety).
Apply proportionality safeguards from Art. 23.

Risk of misuse of public interest to expand data collection.
Risk of rights violations if safeguards ignored.

Public Interest Justification forms completed for each case; Legal/DPO review before invoking public interest.
Proportionality assessment checklist applied to all public interest processing.
Audit trail maintained for NDPC inspection.

Art. 26 (1-2)

Reliance on Legitimate Interest

(1) A data controller shall cautiously consider reliance on legitimate interest as a lawful basis for data processing and shall be required in a compliance audit to show the basis of its preference. A template of a Legitimate Interest Assessment is in Schedule 8.
(2) Section 25 (2) of the NDP Act makes compatibility with contract, vital interest, legal obligation or public interest, a basis for reliance on legitimate interest. Accordingly, it shall be mandatory for a data controller under the circumstances to:
a) Carry out Legitimate Interest Assessment (as prescribed in Schedule 8) before embarking on data processing;
b) Priorities privacy by design and by default – taking into consideration the suitability of anonymisation or pseudonymisation;
c) Identify and document the lawful basis of processing which is compatible with the legitimate interest process;
d) Identify and eliminate data processing that may overreach the fundamental rights and freedoms of data subjects – particularly such processing that may lead to behavioural monitoring or profiling, or lead to targeted advertisement by third parties or partners;
e) Identify and eliminate data processing that may lead to a breach of data confidentiality, integrity and availability – taking into account vulnerable data subjects;
f) Provide transparent information to data subjects in accordance with Section 27 of the NDP Act;
g) Provide for prompt remediation of data subjects’ rights; and
h) Priorities data ethics and utmost duty of care.

The organisation must:

Conduct LIA before relying on legitimate interest.
Prioritise privacy by design/default.
Avoid overreach (profiling, targeted ads, rights breaches).
Document lawful basis and remediation steps.

Risk of invalid legitimate interest claims.
Risk of profiling/targeting violations.
Risk of regulatory sanctions.

LIA template (Schedule 8) completed before processing.
Privacy by design reviews embedded.
DPO review of profiling/targeted processing.
Transparency notices to data subjects.
Records management procedure for documenting lawful basis and remediation actions.

Art. 27 (1-4)

Consideration Regarding Information to Data Subjects

(1) Provision of information to a data subject shall be in accordance with Section 27 of the NDP Act. The information shall be clear and shall take into consideration vulnerable data subjects.
(2) In circumstances of exclusive physical events, interviews or interactions where a data controller or data processor may not be able to provide data subjects with a privacy policy or if provided, the class of data subjects may not be able to understand the privacy policy without the aid of an interpreter, the data controller or data processor shall provide the information in the form that the data subject can understand.
(3) The information to be provided by the data controller or data processor includes but is not limited to the following:
a) The name of the data controller or data processor,
b) Lawful basis of data processing,
c) Types of personal data to be collected, d) The purpose of the processing,
e) The means of processing,
f) Access to personal data by authorised third parties,
g) Purpose of access by third parties,
h) Data subject’s rights,
i) Access to prompt internal remediation through contact to be supplied by the data controller or data processor, and
j) Right to lodge a complaint with the Nigeria Data Protection Commission.
(4) Information to data subjects does not constitute a request for consent. Consent shall be specifically requested and obtained when it is required by law and on the ground that the information which may guide the data subject in making an informed decision has been duly provided prior to the processing of personal data.

The organisation must:

Provide clear, accessible privacy notices.
Adapt notices to vulnerable groups (interpreters, simplified forms).
Cover all mandatory elements (basis, rights, complaints, recipients).
Distinguish between providing information and obtaining consent.

Risk of invalid processing if notices are unclear/incomplete.
Risk of exclusion of vulnerable groups.
Risk of complaints/escalations to NDPC.

Privacy Notice templates standardised.
Accessibility checks for vulnerable users (translations, simplified text).
Website/intranet publication of notices.
DPO approval of all privacy notices.
Training and guidance for staff on differentiating information provision vs. consent collection.

Art. 28 (1-13)

Reliance on Legitimate Interest

The organisation must:

Conduct DPIA before high-risk processing.
File DPIA with NDPC.
Use accredited DPO to certify DPIAs.
Integrate DPIA findings into CAR filings.
Apply privacy by design/default principles.

Risk of NDPC restrictions for failure to file DPIAs.
Risk of rights violations in high-risk processing.
Risk of business disruption if DPIAs not approved.

DPIA template (Schedule 4) adopted.
DPO accreditation verified.
DPIA register maintained.
Board/management approval of DPIA outcomes.
Integration of DPIA findings into compliance audits.
Privacy by design/default checklists built into system development lifecycle.

Art. 29 (1-5)

Monitoring Evaluation

(1) A data controller or data processor shall have schedules for monitoring, evaluation and maintenance of data security systems.

(2) The schedules shall take into account people, processes and technologies involved in data security and each shall contain applicable technical and organisational measures including but not limited to:
(a) Training;
(b) Certifications;
(c) Updates of software;
(d) Vulnerability tests of databases;
(e) Assessment of hardware for repairs or replacements;
(f) Authentication checks;
(g) Encryption reviews; and
(h) Quality Assurance on products and services being used for data confidentiality, integrity and availability.

(3) A data controller or data processor shall assign relevant officers to carry out the tasks under the schedule and stipulate time to take appropriate technical and organisational measures under the schedule.

(4) The schedule shall be vetted and certified by a duly certified information security officer.

(5) Notwithstanding the schedule, a data controller or data processor shall carry out monitoring, evaluation and maintenance of data security systems as frequently as possible, taking into account the risks of data processing.

The organisation must:

Maintain documented schedules for monitoring/evaluating security.
Include people, processes, and technology in scope.
Assign officers to carry out tasks.
Vet schedules through certified security officer.
Perform continuous monitoring based on risk.

Risk of security breaches if systems not tested.
Risk of regulatory penalties for weak controls.
Risk of loss of trust after incidents.

Training & awareness schedule.
ISMS (Information Security Management System) in place.
Assignment of officers documented in security roles & responsibilities.
CISO certification/oversight of security schedule.
Quarterly vulnerability scans & penetration tests; Encryption reviews & key management documented.

Art. 30 (1-8)

Internal Sensitization and Training

(1) A data controller or a data processor shall prepare and implement an organisational schedule for internal sensitisation and training on privacy.

(2) The schedule shall contain a mode of evaluating the level of compliance with the NDP Act, this GAID and other regulatory instruments issued by the Commission.

(3) In respect of people, a data controller or data processor may adopt the use of meetings, questionnaires and interviews.

(4) This schedule shall be used to identify:
(a) Data processing practices to stop,
(b) Data processing practices to start, and
(c) Data processing practices to continue.

(5) A data controller or a data processor shall publish the schedule on appropriate communication mediums where employees and other relevant workers, agents, and contractors, who are engaged in relevant activities may see it.

(6) A data controller or data processor shall:
(a) Review its data processing platforms,
(b) Assign relevant officers to carry out the tasks under the schedule, and
(c) Singulate time for implement appropriate technical and organisational measures.

(7) In order to enable persons engaged in data processing to understand their duties and responsibilities, a data controller or data processor shall develop a basic privacy checklist as a guide.

(8) A data controller or data processor shall develop and implement a written policy for routine checks on compliance practices which may be carried out without notice to employees. This policy may be part of a larger data governance policy of the data controller or data processor.

The organisation must:

Prepare and implement an internal training/sensitisation schedule.
Evaluate compliance regularly.
Identify practices to start/stop/continue.
Publish schedules for staff and contractors.
Assign officers and timelines for actions.
Provide a basic privacy checklist.
Implement surprise compliance checks as part of governance policy.

Risk of low staff awareness of obligations.
Risk of non-compliance from contractors/vendors.
Risk of repeat data handling mistakes.

Annual training calendar on data protection; Mandatory induction privacy training;
Records of staff training completion.
Regular compliance evaluations and reports.
Documented reviews of practices with start/stop/continue actions.
Published training and compliance schedules for staff and contractors.
Assignment of responsible officers and timelines documented.
Basic Privacy Checklist (BPC) distributed org-wide.
Surprise compliance checks by compliance/DPO.

Art. 31 (1-3)

Deployment of a Data Processing Software by a Data Controller or Data Processor

(1)A data controller or a data processor who (whether for itself or for other persons) deploy or intends to deploy data processing software for the purposes of tracking a data subject or enabling a communication link with a data subject and processing his or her personal data, is under an obligation to abide by the provisions of the NDP Act.

(2)For the purposes of complying with this GAID and in addition to other obligations imposed on a data controller or a data processor, it is mandatory for the data controller or data processor in the circumstances referred to in Article 31 (1) to:
a) Carry out a DPIA before the deployment of the software;
b) Ensure that the software is designed in accordance with the principles of privacy by design and by default;
c) Without prejudice to any contrary provisions of the NDP Act or regulatory instruments issued immediately, ensure that the software follows data security guidelines or instructions provided in the stores where the software may be downloaded;
d) Provide data privacy policy within the software;
e) Provide a privacy statement to data subjects (prospective users) prior to installation — expressly indicating the following:
i. The types of personal data to be processed (types to be supplied by the data controller or data processor);
ii. The lawful purpose for processing the personal data (lawful purpose to be supplied by the data controller or data processor);
iii. The personal data to be processed without prejudice to data subjects’ right to privacy;
iv. No personal data will be processed unless such personal data is crucial to the lawful purpose being pursued through the use of the software;
v. Technical and organisational measures are implemented as part of privacy by design and by default (types of technical measures such as encryption should be specifically indicated);
vi. A PPA has been conducted and the result indicates that the use of the software is unlikely to compromise data privacy and protection;
vii. Prompt technical support on data privacy and protection is accessible via the software (link shall be supplied by the data controller);
viii. Self-service measures which may disable, uninstall or restrict the software is available (link shall be supplied by the data controller);
ix. Redress of grievances, right to complain to a data protection authority – (link should be provided by the developer comprising a list of countries and their data protection authorities respectively).
f) The required information in the privacy statement before the installation of the software shall be provided by a data controller or a data processor (as applicable) within six (6) months of the issuance of this GAID; provided that where the software is already in use by the data subjects prior to the issuance of this GAID, an update shall be carried out within six (6) months in order to bring the software into compliance with the NDP Act and this GAID.

(3) Examples of software referred to in this GAID are:
(a) Operating System
(b) Mobile Applications
(c) Device Driver
(d) Firmware
(e) Programming Language Translator
(f) Utilities

The organisation must:

Conduct a DPIA before deploying processing software.
Ensure software complies with privacy by design/default.
Publish a privacy policy and privacy statement within the software.
Provide user safeguards (encryption, uninstall/self-service, redress, complaint mechanisms).
Update existing software within 6 months of GAID issuance to comply.

Risk of data misuse if software not assessed.
Risk of breach of privacy rights from poor design/defaults.
Risk of NDPC penalties for non-compliant deployments.

DPIA register before software deployment.
Privacy-by-design checklist for IT development.
Embedded privacy notice in software.
Technical safeguards (encryption, access controls); Incident redress links in-app.
Update cycle to bring legacy apps into compliance.

Art. 32 (1,2,4)

Measures Against Privacy Breach Abatement

(1) A data controller or data processor shall put in place, appropriate technical and organisational measures to prevent the use of its platform, facility, network or howsoever called, from being used to breach the privacy of a data subject.
(2) When the Commission notifies a data controller or data processor that is platform, facility, network or howsoever called is being used by any person to commit an offence under the NDP Act or to carry out a breach of privacy, the data controller or data processor shall immediately restrict such person on its platform, facility or network, pending the outcome of an investigation by the Commission.

(4) Where a data controller or data processor fails, refuses or neglects to carry out the directive of the Commission to prevent further breach of privacy, the data controller or data processor shall be deemed as abetting a breach of privacy and shall be accountable for violations of the NDP Act as if it directly committed a breach of data privacy.

The organisation must:

Put safeguards to prevent systems/platforms from being used to breach privacy.
Immediately restrict users flagged by NDPC for breach until investigation concludes.
Comply with Commission directives to stop privacy breaches.

Risk of platform abuse for unlawful data processing.
Risk of enforcement action if breaches continue unchecked.
Risk of accountability as abettor.

Access control systems (ID verification, monitoring); Audit logs for Commission verification.
Automated restrictions on flagged users.
Incident response procedure linked to NDPC notices.
Audit logs for Commission verification.

Art. 33 (1-5)

Data Breach Notification

(1) The NDP Act under Section 40(2) provides that “a data controller shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach and, where feasible, describe the nature of the personal data breach including the categories and approximate numbers of data subjects and personal data records concerned.”

(2) A breach is likely to result in a high risk to the rights and freedoms of individuals if, considering the nature of the breach, the personal data involved as well as the probability of accessing other personal data of the data subject through the breach, he/she subject may become a victim of fraud, identity theft or exposure of sensitive personal data.

(3) In line with Section 40(2) of the NDP Act, a data controller shall notify affected data subjects immediately after becoming aware of the breach in order to ensure that data subjects are not unlawfully targeted as a result of the breach. This is in furtherance of the principle of duty of care and accountability.

(4) Notwithstanding the time provided for the notification of a data breach, a data controller or data processor shall exercise a duty of care by providing immediate information on data breach to all relevant authorities including the Commission, if such immediate information may help in containing imminent data breaches on a national scale or when containment measures may be necessary at national, sectoral or at an individual level or where it may affect members of the general public.

(5) The content of a data breach notification to the Commission shall include the following among others:
a) A description of the circumstances of the loss or unauthorised access or disclosure;
b) The date or time period during which the loss or unauthorised access or disclosure occurred;
c) A description of the personal information involved in the loss or unauthorised access or disclosure;
d) An assessment of the risk of harm to individuals as a result of the loss or unauthorised access or disclosure;
e) An estimate of the number of individuals to whom there is a real risk of significant harm as a result of the loss or unauthorised access or disclosure;
f) A description of steps the organisation has taken to reduce the risk of harm to individuals;
g) A description of any steps the organisation has taken to notify individuals of the loss or unauthorised access or disclosures; and
h) The time and contact information of a person who can answer on behalf of the organisation, the Commission’s questions regarding the loss of unauthorised access or disclosure of personal data.

The organisation must:

Notify NDPC of data breaches within 72 hours.
Inform data subjects immediately if high risk.
Provide immediate info to NDPC and authorities for large/national risks.
Include mandatory details in breach reports

Risk of late notification fines.
Risk of identity theft/fraud for affected subjects.
Risk of public trust erosion.

Breach response plan (72h SLA).
Communication protocols for data subjects.
Communication protocols for NDPC and authorities.
Breach reporting templates with required fields.

Art. 34 (1-4)

Data Processing Agreement

(1) In line with Section 29(2) of the NDP Act, a data processor is expected to rely on a Data Processing Agreement (DPA) with the data controller in order to carry out data processing on behalf of the data controller.

(2) In addition to other relevant terms and conditions as may be prescribed by law, a DPA shall include the following:
a) Obligations of the data controller and data processor under Section 29 of the NDP Act;
b) Name of parties;
c) Addresses of parties;
d) Recitals containing reference to any Principal Agreement or Service Level Agreement;
e) Purpose of data processing;
f) Location of data processing (taking into account the provisions of the NDP Act on cross-border data transfer);
g) Scope of the processing;
h) Lawful uses of data processing;
i) Responsibilities of parties under the DPA;
j) Technical and Organisational Measures for data protection (if highly technical or scientific, it should be expressly outlined in a schedule to the DPA);
k) The outcome of a DPA where relevant;
l) Potential risks;
m) NDP Act compliance (evidence of registration with the Commission should be ascertained);
n) Confidentiality;
o) Tenure;
p) Specific Restrictions;
q) Indemnity;
r) Insurance;
s) Force Majeures; and
t) Dispute Resolution.

(3) A party to any DPA other than an individual data subject, shall take reasonable measures to ensure that the other party is compliant under the NDP Act, accountable to the Commission or, in the case of a foreign party, to a competent regulatory authority outside Nigeria; accordingly, every data controller or data processor shall be accountable for the actions or inactions of third parties it engages or permits to carry out data processing.

(4) Where a party to an agreement operates as a sole proprietorship, an individual agent or a self-employed worker, by reason of which he or she may not be organised to fulfil the obligations of corporate entities, such a person or individual shall for the purposes of his or her engagement in high-risk data processing, be required to be trained in data protection and privacy. Evidence of training and registration as a data processor of major importance shall be relied upon as a rebuttable proof of compliance with the NDP Act.

The organisation must:

Have DPAs in place with all processors.
Ensure DPAs cover all required clauses (scope, lawful bases, safeguards, dispute resolution, indemnity).
Verify processors’ NDPC compliance/registration.
Ensure sole proprietors/agents handling high-risk data are trained and registered.

Risk of non-compliant outsourcing.
Risk of weak liability/indemnity clauses.
Risk of regulatory sanctions for third-party misconduct.

Standard DPA templates approved by Legal/Compliance.
Vendor onboarding checklist requiring NDPC registration.
Periodic processor audits.
Training certificate checks for sole agents.

Art. 35 (1-4, 6-7)

Benchmarking with Interoperable Data Privacy Measures

(2) In the event that a data controller, data processor is to take a decision on an applicable technical and organisational measure for safeguarding data privacy rights, it is legally imperative to take into account the provisions of the extant Fundamental Rights Enforcement Procedure Rules in Nigeria on the importance of municipal, regional and international bill of rights.

(3) In furtherance of Article 56 (1), (2), a data controller or data processor may, subject to the approval of the Commission, benchmark its data processing with Interoperable Data Privacy Measures (IDPMs) in circumstances where a specific directive is required by the Commission under the NDP Act.

(4) Where a data controller or data processor intends to benchmark with an IDPM which expressly requires directives of the Commission under the NDP Act, it shall seek the approval of the Commission through an application stating the following:

a) The name and address of the data controller or data processor,

b) The nature of business

c) The purpose and lawful bases of data processing,

d) The nature of data processing in which an IDPM is required,

e) The author and the jurisdiction of the IDPM being proposed for approval,

f) The benefit of the IDPM in data processing value chain,

g) The benefit of the IDPM to the ecosystem,

h) Three (3) use cases of the IDPM,

i) Any disadvantage of the IDPM, and

j) The name and contact details of its certified DPO.

(
(6) For the purposes of Article 15 (1) – (5), IDPM means best practice templates which are not limited by jurisdictional procedures and are particularly in finitenance of the NDP Act. Accordingly, instances where IDPM may be used include but are not limited

b) Automated Decision Making,

c) Child Online Protection,

d) Data Preliability,

e) Data Subject-Access Request,

f) Data Privacy Impact Assessment,

g) Deployment of Artificial Intelligence,

h) Encryption,

i) Promise Data Security Audit,

j) Legitimate Interest Assessment,

k) Pseudonymisation, and

l) Record of Processing Activities.

(7) Without prejudice to the provisions of the NDP Act and any regulatory instrument issued by the Commission a DPO is required to consider suitable IDPMs which maybe used by a data controller or a data processor as part of global best practices in data processing. Accordingly, it is appropriate for a DPO to proactively review IDPMs prior to when the need for them arises. The Commission shall continuously provide

The organisation must:
Consider global best practices (IDPMs).
Seek NDPC approval before using IDPMs that require it.
Document benefits/risks of IDPM adoption.
Ensure IDPMs do not undermine Nigerian constitutional rights.

Risk of misaligned standards.
Risk of non-approved benchmarking.
Risk of data subject rights erosion.

Compliance review of IDPM proposals.
Approval workflow with NDPC.
Use-case documentation (e.g., AI, encryption, SARs).
DPO maintains IDPM register.

Art. 36 (1-5)

Exercise of Right to Rectification

(1) The right to data rectification is essential to the operation of the principle of data accuracy under the NDP Act.
(2) A data controller or processor shall ensure that the platforms through which it processes personal data also provides an effective opportunity for data rectification.
(3) Data rectification may not depend on the provision of an affidavit or a publication in a newspaper provided that the rectification is to bring the data into alignment with the personal data relating to the data subject’s National Identification Number (NIN).
(4) Where data rectification is for the purpose of correcting an error made by a data controller or a data processor in inputting the personal data of a data subject, the data subject shall not be required to pay in order to correct an error which is not his or her fault. Accordingly, it is important to ensure that a data subject is provided with manifestly ample opportunity to verify his or her data before such data is submitted in a permanent format.
(5) Whenever there is a dispute as to whether a data subject was provided with manifestly ample opportunity to verify his or her personal data before being submitted in a permanent format, the data controller or data processor shall provide the evidence of the manifestly ample opportunity. Accordingly, data processing platforms together with the technical and organisational measures for their operations shall be designed in a way that may allow a data controller or data processor to audit any source of error.

The organisation must:

Allow subjects to correct inaccurate data easily.
Ensure rectification is free if controller error.
Provide ample opportunity to verify data before it becomes permanent.
Retain audit trail of rectifications.

Risk of data inaccuracy.
Risk of unfair burden on subjects.
Risk of eroded trust due to rectification barriers.

Self-service rectification portal.
Policy prohibiting affidavit/newspaper requirements.
Verification steps before permanent record creation.
Rectification logs reviewed by DPO.

Art. 37 (1-6)

Exercise of Right to Data Portability

(1) A data subject has a right to data portability.

(2) The right to data portability shall apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It may not apply where processing is based on a legal ground other than consent or contract.

(3) The right to data portability may not apply against a data controller or data processor in the performance of its public duties; unless there is a compelling legitimate interest or right of a data subject that may be abridged by reason of denying the data subject’s right of data portability.

(4) Where, in a certain set of personal data, more than one data subject is concerned, the right to receive the personal data should be without prejudice to the rights and freedoms of other data subjects in accordance with the NDP Act or any regulatory instrument issued by the Commission.

(5) The right to data portability shall not prejudice the right of the data subject to obtain the erasure of personal data and the limitations of that right as prescribed under the NDP Act.

(6) Nothing in this Article shall imply the erasure of personal data concerning the data subject which has been provided by him or her for the performance of a contract to the extent that and for as long as are necessary for the performance of that contract.

The organisation must:

Enable export/transfer of data provided by subjects (under consent/contract).
Ensure portability does not prejudice others’ rights.
Clarify limits where legal duties/public interest apply.
Provide clear process for portability requests.

Risk of non-compliance with portability requests.
Risk of prejudice to other data subjects.
Risk of technical barriers preventing portability.

Data export tools (CSV/JSON/Excel).
Technical compatibility measures with industry standards (APIs).
Portability request policy.
DPO oversight of portability cases.

Art. 38 (1-4)

Exercise of Right to be Forgotten

(1) A data subject has the right to have his or her personal data erased if:
a) The personal data is no longer necessary for the purpose a data controller or data processor originally collected or processed it.
b) A data controller or data processor is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws his or her consent.
c) A data controller or data processor is relying on legitimate interest as its justification for processing an individual’s data, of which, the individual objects to this processing, and there is no overriding legal ground for the organisation to continue with the processing.
d) A data controller or data processor is processing personal data for direct marketing purposes and the individual objects to this processing.
e) A data controller or data processor processed an individual’s personal data unlawfully.
f) A data controller or data processor must cause personal data in order to comply with a legal ruling or obligation.

(2) However, an organisation’s interest in processing the personal data may override a data subject’s right to be forgotten if:
a) The data is being used to exercise the right of freedom of expression and information subject to the limit of derogation permitted under Section 45 of the 1990 Constitution and other safeguards of the NDP Act.
b) The data processing is necessary:
i. to comply with a legal ruling or obligation.
ii. to perform a task that is being carried out in the public’s interest or when exercising an organisation’s official authority.
iii. for public health purposes and to serve the public interest.
iv. to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy.
c) The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely impair or halt progress towards achieving the goal of the processing.
d) The data is being used for the establishment of a legal defence or in the exercise of other legal claims.

3) Without prejudice to the provisions of the NDP Act, where a data controller or data processor has made personal data public or has shared data with third parties, the data controller is under obligation to ensure the erasure of such personal data by the third parties at the request of the data subject or in compliance with the directives of the Commission in that regard.
(4) This right may not apply where there is a public interest pursued by disclosure of the data to the general public – provided that the burden of proving the existence of a public interest shall be on the data controller who intends to keep the personal data public.

The organisation must:

Erase data when lawful grounds exist (consent withdrawal, unlawful processing, etc.).
Assess exceptions before erasure (public interest, health, legal obligations).
Ensure third parties delete shared data upon request.
Document erasure requests and responses.

Risk of retaining data unlawfully.
Risk of erasing data that should be retained (public interest/legal duty).
Risk of failure to cascade deletion to third parties.

Erasure request workflow.
Public interest/legal retention assessment checklist.
Third-party deletion assurance letters.
Erasure logs and approvals.

Art. 39 (2, 7, 8)

Exercise of Right to Lodge a Complaint with the Commission

(2) Every regulation, policy, framework, or legal instrument which pertains to the processing of personal data shall in addition to all applicable data subject rights and safeguards contained a clause on the right to lodge a complaint with the Nigeria Data Protection Commission.

7.The notice of investigation may require the respondent to provide, where applicable: 1. (a)The information itemised under this Sub Article. 2. (b)The list of third-party data processors, agents or contractors engaged by the respondents for data processing together with data processing agreements and evidence of compliance with the NDP Act; 3. (c)Foreign countries to which the respondent transfers personal data together with the legal basis relied upon for the transfer; 4. (d)DPIA for technologies and methodologies relied on for personal data processing; and 5. (e)Name and official contact details of the respondent’s DPO.

8.The respondent shall, except as otherwise specified by the Commission, reply the Commission within twenty-one (21) days.

The organisation must:

Recognise and facilitate the right of data subjects to lodge complaints with NDPC.
Provide full details during investigations, including third-party processors, DPAs, transfer adequacy bases, and DPO contacts.
Reply to NDPC within 21 days unless given another deadline.

Risk of non-compliance with NDPC timelines.
Risk of failure to disclose third-party processing activities.
Risk of sanctions for incomplete or misleading responses

Complaints management procedure.
DPO maintains updated list of processors, contracts, transfers, and DPIAs.
Register of complaints and NDPC responses; Standard response timelines documented.

Art. 40 (2-4, 6, 8)

Data Subject’s Standard Notice to Address Grievance

(2) An aggrieved data subject may cause SNAG to a data controller or a data processor where the data subject reasonably believes that the data controller or data processor violated his or her right to data privacy.

(3) SNAG shall not be regarded as a condition precedent for lodging a direct complaint with the Commission or for instituting an action, rather it shall be regarded as a standardised template for demanding internal remediation in an organisation which may be acting in violation of a data subject’s privacy.

(4) SNAG may be served directly by a data subject or by a person acting under his or her authority or by a civil society organisation acting in the public interest.

(6) Upon receipt of a SNAG, a data controller or a data processor shall communicate its decision on the SNAG to the Commission through the designated electronic platform.

(8)A SNAG may be served on a data controller or a data processor via its physical sources, telephone messaging medium, e-mail address, courier service or other reasonable means of correspondence.

The organisation must:

Accept SNAGs through multiple reasonable channels (email, courier, phone, physical).
Treat SNAGs as internal grievance notices and respond accordingly.
Notify NDPC of decisions taken on SNAGs through the electronic platform.

Risk of ignoring SNAG notices.
Risk of poor grievance-handling record.
Risk of escalation to NDPC with reputational consequences.

Dedicated grievance contact points; SNAG handling SOP.
Escalation process to Compliance team.
SNAG logbook/reporting to NDPC.

Art. 41 (1-11)

Data Ethics, Privacy and Dignity of the Human Person

(1) A data controller or a data processor shall prioritise the principles of data ethics which offer additional safeguards to the privacy and dignity of the human person.
(2) To fortify the principles of the sanctity of personal information and the preservation of human dignity, both data controllers and data processors must steadfastly adhere to the tenets of data ethics.
(3) Data ethics, as enshrined in this Article, serves as an indispensable guide, elevating the standards of safeguarding individuals’ privacy and upholding their inherent dignity.
This entails a commitment to transparency, fairness, and responsible data management practices.
(4) Transparency forms the bedrock of ethical data handling. Data controllers and processors must furnish individuals with clear and comprehensible information
regarding the collection, processing, and storage of their data. This ensures that individuals are well-informed, empowering them to make informed decisions about
their personal information.
(5) Fairness in data processing underscores the commitment to impartiality and equity. Discrimination based on gender, ethnicity, religion, physical ability or any other characteristic is strictly prohibited. Every individual is entitled to equal protection, fostering an inclusive digital landscape.
(6) Responsible data management involves the implementation of robust security measures to protect against unauthorised access, breaches, or any form of misuse. It requires the continuous evaluation and enhancement of data protection protocols to adapt to evolving technological landscapes.
(7) Emphasising the dignity of the human person, data controllers and processors must acknowledge the intrinsic value of every individual’s data. The extraction, processing, or utilisation of data must not compromise the autonomy, freedom, or integrity of any person.

(8) Any data collection or processing that may result in harm, discrimination, or violation of individual rights is strictly prohibited. Safeguards should be in place to prevent the creation of profiles or the application of algorithms that could lead to prejudiced outcomes.
(9) In cases where data is shared with third parties, explicit consent must be obtained from the data subject. The purpose, scope, and duration of such data sharing must be clearly communicated, and individuals should retain the right to revoke consent at any time.
(10) Continuous education and awareness programs should be implemented to keep individuals informed about their digital rights, empowering them to exercise control over their personal data.
(11) The principles outlined in this article reflect a commitment to building a digital ecosystem that respects the fundamental rights of individuals. By prioritising data
ethics, we aim to create a responsible and trustworthy digital environment that values and protects the privacy and dignity of every human person.

The organisation must:

Uphold transparency, fairness, and non-discrimination in data processing.
Provide clear and accessible information to subjects.
Protect personal data with strong security measures.
Respect autonomy and dignity of individuals.
Obtain explicit consent before third-party sharing.
Prohibit harmful profiling or discriminatory algorithmic outcomes.
Run awareness/education programmes on data rights.

Risk of bias, discrimination, unfair profiling.
Risk of unethical algorithmic outcomes.
Risk of loss of trust in organisation.

Data ethics policy/code of conduct; Fairness and transparency assessments.
Fairness and transparency assessments.
Strong security measures (aligned with existing ISMS and technical safeguards).
Data ethics policy/code of conduct.
Consent management procedures.
Non-discrimination checks in algorithms.
Ongoing privacy awareness training.

Art. 42 (1-5)

Application of Global Best Practice on Data Ethics

The global best practice on the principles of data ethics to which a data controller or a data
processor may be audited are:
(1) Organisational Policy on Ownership of Data – taking the following into consideration:
(a) Personal data, to all intents and purposes, belong to the natural person to whom it relates. Accordingly, it shall be construed as unethical to process data in a manner that the owner may object, taking into account, law, culture and faith.
(b) Where there are ethical concerns on individual’s expectations on the use of his or her data, it is appropriate to anonymise the data and to only process it within the confines of the laws to which the individual is subject.
(c) Where there are proceeds from the lawful use of other people’s property – in this case, personal data – it is to be considered ethical for the user to create ample
opportunity for them to benefit from the proceeds through corporate social responsibility or other similar measures.
(2) Demonstrable Transparency and Accountability – taking the following into consideration:
(a) Processing of data shall not only be transparent; it shall also be seen to be transparent through accountability.
(b) The ethical standard particularly where the data controller is relying on consent, contract, vital interest, or legitimate interest, is to disclose all information upon
which a data subject may make an informed decision.
(c) Information that is expected to be disclosed includes, the information required by the NDP Act to be disclosed generally to the data subjects and the following:
i. Expected outcomes of the purpose of processing for the data controller and those with whom the data may be shared;
ii. Capabilities of the technology used for processing – particularly, the use of algorithms for profiling, the risks involved, mitigation of risks, and
iii. Effective channel for redressing grievances.
(d) A data controller or data processor who neglects to be demonstrably transparent may be acting in violation of the principle of transparency under the NDP Act.
Thus, taking into account the ownership of data, the requirement for duty of care, and the liability of the controller or processor, may include a breach of trust.
(e) Designation of a DPO (and providing him or her with full support to carry out data protection tasks) as well as filing of NDP Act CAR with the Commission are part of the ways of demonstrating transparency and accountability.
(3) Informational Autonomy or Informational Self-Determination – taking the following into consideration:
(a) A data controller or data processor shall respect the informational autonomy of a data subject by making sure that his or her data are not carelessly, recklessly or negligently shared, even when consent has been obtained.
(b) Where sharing of information may lead to prejudice or abuses, efforts shall be made by the data controller or data processor to mitigate these risks.
(c) Processing to portray, project or propagate indecent acts shall be regarded as a violation of the principle of fairness under the NDP Act – initial consent of the data subject notwithstanding.
(4) Fairness of Intention – taking the following into consideration:
(a) A data controller or data processor shall take the lawfulness of the purpose of processing into account when processing personal data. The notion that what is not prohibited is permitted does not apply in data processing ethics.

(b) A data controller or data processor shall ensure that its intention is clear and understandable to the data subject – particularly in the context of consent, contract and legitimate interest.
(5) Assessment of Outcomes – taking the following into consideration:
(a) A data controller or data processor shall put in place adequate technical and organisational measures for the assessment and appreciation of data processing
outcomes.
(b) The measures may involve the use of sandboxes and simulations particularly where there is a likely or probable outcome of harm or injury to a data subject.
(c) An outcome that is adversely different from the original expectation of the processing, shall be treated as a disparate outcome which may upon investigation by the Commission, result in a liability for the violation of the principle of duty of care under the NDP Act.
(d) A data controller or data processor shall take into consideration the interlinked character of human rights and their attribute of inalienability – subject to lawful derogations – when carrying out an assessment of outcomes.
(e) A data controller or data processor is expected to rely on a DPIA in order to assess the outcomes of a proposed data processing activity. Thus, while undertaking a DPIA, further analysis of potential disparate impact is required
in order to achieve appropriate standards of data ethics in data processing.
(f) Assessment of Outcomes in this Article means a systematic analysis of the effect or result of data processing particularly on the enjoyment of other
fundamental rights and freedoms.

The organisation must treat personal data as belonging to the subject, apply anonymisation when ethically required, demonstrate transparency and accountability in processing, ensure fairness of purpose in all processing, and assess outcomes using DPIAs, sandboxes, and simulations.

Risk of unethical data monetisation.
Risk of breach of trust due to lack of transparency.
Risk of harmful or unexpected outcomes.

Ethical data use policy; DPO oversight of fairness and autonomy.
Ethical data use policy; Anonymisation procedures/checklists.
Transparency reports/disclosures.
DPO oversight of fairness and autonomy.
Outcome assessment framework (DPIAs, sandboxes).

Art. 43 (1-5)

Emerging Technologies

1) A data controller or a data processor who deploys or intends to deploy Emerging Technologies (ETs) such as Artificial Intelligence, Internet of Things and Blockchain
for the purposes of processing personal data shall take into consideration:
(a) The provisions of the NDP Act,
(b) Public Policy, and
(c) This GAID, and other regulatory instruments issued by the Commission in order to safeguard the privacy of data subjects.
(2) A data controller or a data processor who deploys or intends to deploy ETs for the purposes of processing personal data is expected to set forth technical and organisational parameters for the processing in order to design its ET tools in accordance with the threshold of data processing permitted by law – particularly
taking into account the:
a) Right of a data subject not to be subject to a decision solely based on automated processes or algorithms;
b) Right to be forgotten – and the possibility of using synthetic data or tokenisation of personal data which may not be amenable to this right;
c) Safeguards for the processing of sensitive personal data;
d) Safeguards for child rights and other vulnerable groups;
e) Regulation of cross-border data flows; and
f) Privacy by design and by default.
(3) The technical and organisational parameters are to be documented and filed with the Commission as part of NDP Act CAR.
(4) A data controller or data processor under the circumstances contemplated by this Article shall:
(a) Carry out a DPIA – particularly taking into account:
i. Assessment of disparate outcomes of data processing.
ii. Data Subjects’ Vulnerability Indexes (DSVI) as stated in Schedule 6 and
the DPIA shall be filed with the Commission as part of NDP Act CAR.
(b) Determine the suitability of:
i. Data anonymisation upon collection either directly from data subjects or from any legitimate source.
ii. Testing the ETs in low-risk environments where public interest may be served for a reasonable period and where significant outcomes of their use may be observed.
(c) Determine whether there are disparate outcomes and the possibility of effectively addressing the disparate outcomes.
(d) Retool and return (repeatedly as occasions may warrant) to the controlled environment to re-test the ETs tools until satisfactory outcomes are achieved
or a determination may be made to wholly discard the ETs tools on the ground of unmitigable risk to privacy.
(e) Where a determination has been made that the ETs are safe for use, a data controller shall put in place a mechanism for continuous monitoring and evaluation in all circumstances where they may be deployed.

5) In this Article, the “suitability” or the “possibility” of a safeguard or an act implies an obligation on the part of a data controller or a data processor to take reasonable
technical and organisational measures in guaranteeing fair and accountable use of data – taking into consideration data ethics and regulatory audits.

The organisation must:

Consider NDP Act, GAID, and public policy when deploying Emerging Technologies.
Establish technical/organisational parameters for ET tools.
Protect subjects from automated-only decisions.
Safeguard sensitive data, children, and vulnerable groups.
Regulate cross-border ET data flows.
Embed privacy by design/default.
Conduct DPIAs including disparate outcome and DSVI analysis, and file with NDPC.
Use anonymisation/testing in low-risk environments before deployment.
Re-test/retool ET tools until safe or discontinue if risks cannot be mitigated.
Monitor and evaluate ET tools continuously post-deployment.

Risk of algorithmic harm/discrimination.
Risk of unsafe deployment of ET tools.
Risk of child/vulnerable group exploitation.
Risk of cross-border non-compliance.

ET governance framework.
ET governance framework; Technical/configuration standards for ET tools.
Data ethics and DSVI checklists.
Data ethics and DSVI checklists.
Cross-border data transfer policy & approval workflow.
Privacy-by-design checklist for ET tools.
Pre-deployment DPIA & suitability testing.
Controlled sandbox testing; Anonymisation procedures.
Re-testing/retooling procedures; Risk mitigation assessment logs.
Continuous monitoring logs.

Art. 44 (3)

Parameters for Assessing Emerging Tech

(3) A data controller or data processor who intends to process personal data in the circumstances contemplated by Article 44 (2), may benchmark with global consensus on ETs such as the United Nations Resolution on Artificial Intelligence. Accordingly, data controllers and data processors shall, among other self-correcting measures, remain from or cease the use of ET systems that are impossible to operate in compliance with international human rights law or that pose undue risks to the enjoyment of human rights.

The organisation must:

Benchmark ET use against international human rights standards.
Cease use of ETs that cannot comply with human rights law.
Document benchmarking and compliance reviews.

Risk of human rights violations from ETs.
Risk of NDPC sanctions for unsafe ET use.
Risk of reputational damage.

Benchmarking register; Global consensus monitoring (UN/EU standards).
ET discontinuation protocol for non-compliance.
Compliance review logs; Documentation of benchmarking activities.

Art. 45 (2)

Cross-Border Data Transfer

2) Pending the issuance of any regulatory instrument by the Commission on cross border data transfer, the explanatory note in Schedule 5 of this GAID shall be used
for the evaluation of countries for the purposes of determining their level of adequacy and for other grounds of cross-border data transfer recognised under the NDP Act.

The organisation must:

Assess destination countries’ adequacy before any cross-border transfers.
Use GAID Schedule 5 as reference for adequacy decisions.
Document evaluation before transfers occur.

Risk of illegal transfers to non-adequate jurisdictions.
Risk of cross-border enforcement penalties.

Cross-border transfer policy.
Adequacy assessment template (Schedule 5).
Approval register for international transfers.

Art. 46 (1,3)

Capacity Building and CPD Requirements

(1) Capacity building is mandatory as an organizational measure of data privacy and protection.

(3) All employees and other persons who are engaged by the data controller or data processor shall be trained and sensitized periodically on emerging developments in data processing and to such an extent that is reasonably relevant to their job descriptions respectively.

The organisation must:

Provide regular training and CPD for all staff and contractors handling data.
Tailor training to job roles and emerging developments.
Keep records of training completion.

Risk of low staff awareness.
Risk of breaches due to lack of training.
Risk of repeat non-compliance.

Training calendar & materials.
Role-based training modules.
Attendance/CPD records.

Art. 48 (1, 2)

Evidence of Compliance with the NDP Act

(1) Evidence by a data controller or a data processor relating to compliance with the NDP Act or any regulatory instrument issued by the Commission shall be evaluated in the context they directly relate to.

(2) Compliance in relation to registration, filing of annual CAE, submission of DPIA or cross-border transfer instruments approved by the Commission shows commitment to accountability and prima facie good faith in data processing. It does not replace the need to provide concrete evidence in defence of any complaint of violation relating to other provisions of the NDP Act.

The organisation must:

Maintain proper evidence of compliance (registration, CAR, DPIAs, approvals).
File required returns with NDPC on time.
Retain evidence to respond to complaints or investigations.

Risk of inability to defend against complaints.
Risk of NDPC penalties for poor documentation.
Risk of perceived bad faith.

Compliance evidence repository.
Annual CAR filing schedule.
Audit-ready documentation system.

Art. 49 (2-4)

Consideration of Time-Bound and Non-Time-Bound Obligations

(2) Where the NDP Act or any regulatory instrument issued thereunder does not make an obligation to be timebound, it is expected that such obligation shall be discharged
timeously taking into account the urgency of such obligation to the realisation of the rights and interests of the data subjects that are immediately connected to them, and, also, taking into account that if such obligation is not performed within a definite time frame which may be provided by the data subject, the rights and interests of the data subject may likely be abridged or defeated.
(3) In circumstances requiring storage limitation, where no timebound obligation has been provided by law, the storage time for the purpose of data processing shall lapse not later than six (6) calendar months when the original purpose of the processing has been accomplished.
(4) Notwithstanding Article 49(3) and subject to the principles of data protection under section 24 of the NDP Act, a data controller may store personal data with appropriate technical and organisational measures for the purposes of defence of a legal claim or due diligence.

The organisation must:

Fulfil obligations promptly even if not time-bound by law.
Delete or anonymise data within 6 months of completing processing purposes.
Retain data beyond 6 months only if justified for legal claims/due diligence, with safeguards.

Risk of indefinite retention of data.
Risk of abridged rights due to delays.
Risk of regulatory sanctions for unjustified retention.

Data retention and deletion policy.
Automated deletion schedule (≤ 6 months).
Legal hold procedure for claims/due diligence; Audit log of retention justifications.

Art. 50 (1)

Supplementary Regulations, Directives and Schedules

(1) The Commission may at any time issue supplementary regulations and directives for the purposes of amending this GAID, accordingly, a data controller or a data processor shall comply with the provisions of the supplementary instrument as may be issued by the Commission.

The organisation must:

Monitor and comply with new NDPC regulations/directives.
Update policies, contracts, and practices accordingly.

Risk of non-compliance with new directives.
Risk of outdated policies/procedures.

Regulatory watch process; DPO tracks NDPC circulars.
Policy update workflow; Staff briefing/training on new rules.

Art. 51 (2,3)

Review of Administrative and Financial Obligations

(2) A data controller or a data processor or an intervener who seeks a review under this Article shall specifically demonstrate how any ground for review stated in Article
51(1) applies to a data controller or a data processor or to an intervener.
(3) Application for a review under this Article shall be made in writing to the National Commissioner and Chief Executive Officer of the Commission and it shall be
supported by a verifying affidavit stating, among others:
(a) The name of the affected data controller or data processor or intervener;
(b) The contact address;
(c) The designated DPO and his or her contact;
(d) The nature and scope of data processing;
(e) A summary of facts in proof of the ground or grounds relied upon; and
(f) A declaration of commitment to the principles of data protection and safeguards for the rights and freedoms of data subjects.

The organisation must:

Apply formally to NDPC for review when disputing obligations.
Provide affidavit with required details (organisation, contact, DPO, scope, facts, declaration of commitment).

Risk of rejection of review due to incomplete filings.
Risk of financial/administrative burden if reviews are not sought.

Template for review applications; Tracking system for review requests and outcomes.
Legal review of affidavit content; DPO sign-off before submission.

About the Nigeria Data Protection Act 2023 – General Application and Implementation Directive (GAID) 2025

Article

Title

Regulatory Description

Compliance Obligation

Risk Description

Controls

About us

BIC Advisory Services Limited is a consultancy firm focused on helping individuals and organizations make better decisions. We assist organizations to achieve their purpose by improving the effectiveness of how decisions are made and implemented.

Quick Link

Services

Contact

© 2025 BIC Advisory Services Limited - All Rights Reserved.